The Internet is now an essential segment of our societal infrastructure. Besides the best effort type data conventionally used, data is now starting to be sent that requires guaranteeing the communication quality. Data whose communication quality must be guaranteed includes for example, transaction data for backbone jobs (essential business task) as well as audio and motion picture data. Moreover ADSL (Asymmetric Digital Subscriber Line) and FTTH (Fiber To The Home) technology is causing access lines to shift to broadband so that the volume of data being sent is vastly increasing.
Because of this type of environment, communication business operators and ISP (Internet Service Providers) require functions to monitor networks by collecting statistics on the volume of data being sent and received over network and to analyze those collected statistics, in order to determine the status of communications on the network.
Particularly needed among network monitoring functions, are functions for collecting statistical information on data groups (hereafter, called flows) sorted according to the data transmit source, data destination, application, and quality level, as well as functions for analyzing the statistical information of each flow.
When providing quality-guaranteed communication services, communication business operators and ISP can confirm whether or not communication quality is guaranteed or not by utilizing the statistical information in each flow. Traffic engineering (TE) is also utilized for making efficient use of network resources via the statistical information in each flow, in an environment where the volume of data being sent and received is increasing even though network resources are limited.
Moreover, utilizing statistical information on flows allows predicting customer demand and preparing network resources in advance, so that provisioning can be implemented to speedily provide network resources to meet user requests. Using statistical information to analyze flows also allows detecting and analyzing external computer attacks on the network. Further, billing and similar functions can also be contrived by using this statistical information on flows.
Functions to collect statistical information are contained in node devices such as switches, and routers that transfer packets over the network.
The statistical information collecting system includes a collector device for analyzing the overall network traffic based on statistical information sent from multiple statistical information collecting apparatuses dispersed throughout the network, and from statistical information sent from these statistical information collecting apparatuses.
One method for collecting statistical information on flows is a sampling flow statistical technique is disclosed (See IETF RFC3176 “InMon Corporation's Flow: A Method for Monitoring Traffic in Switched and Routed Networks”). In the statistical information collecting system disclosed in IETF RFC3176 “InMon Corporation's Flow: A Method for Monitoring Traffic in Switched and Routed Networks”, a router serving as the statistical information collecting apparatus copies the received packet and selectively sends the copied packets to the collector device. The collector device then identifies the flow from the packets that were sent, and collects and analyzes the statistical information.
Routers contained in the statistical information collecting system sample the received packets according to a sampling rate set in advance by the network administrator, places the sampled packet copies in a specified capsule format and sends this to the collector device.
The collector device extracts the copied packet from the packet sent from the router, identifies the flow based on the copied packet header information and, information for identifying added flows if necessary, and rewrites the statistical information for each flow.
An expanded sampling type statistical information collecting system is disclosed (See JP-A No. 5402/2006) as a technology for sampling in flow units. In contrast to the flow statistic technology of IETF RFC3176 “InMon Corporation's Flow: A Method for Monitoring Traffic in Switched and Routed Networks”, where packets are sampled at a fixed (specified) rate from among packets received by a router, in the flow statistic technology of disclosed in JP-A No. 5402/2006, the flow is identified from header information in the packet received by the router, and the packets are sampled at a rate set for each flow.